operator-plane: fix dashboard POST NameError (import os/hmac)

Every POST endpoint (approve/reject/exit/watch) crashed with NameError:
do_POST references os.environ + hmac.compare_digest but neither was imported.
Adds the imports, a non-loopback regression test for the token gate (no token
-> routes; token set -> 401 without/with-wrong header, 200 with correct), and
plumbs DASHBOARD_TOKEN + PG_SKIP_SCHEMA=1 into both compose dashboard services
(+ .env.example docs for DASHBOARD_TOKEN / COMMAND_BUS_ENABLED).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -9,6 +9,14 @@
 TOKEN_ENCRYPTION_KEY=<REDACTED>
 
 DASHBOARD_PORT=8765
+# Dashboard POST auth + operator command bus (the :8765 kill switch).
+# DASHBOARD_TOKEN is REQUIRED-when-commands-on: /api/command returns 503 unless
+# it is set (commands never run unauthenticated); it also gates approve/reject/
+# exit POSTs. Empty = read-only dashboard, no command bus. Keep it out of logs.
+DASHBOARD_TOKEN=
+# Enable the operator command bus (flatten-all / flatten-symbol / pause / resume).
+# Needs DASHBOARD_TOKEN set too; the loop consumes commands on its 5s guard.
+COMMAND_BUS_ENABLED=0
 #curl.exe -H "APCA-API-KEY-ID: $key" -H "APCA-API-SECRET-KEY: $secret" https://paper-api.alpaca.markets/v2/account
 # Alpaca API (primary data provider)
 ALPACA_API_KEY=<REDACTED>